Kubernetes

Theory

Kubernetes orchestrates containers across a cluster of nodes. The control plane (API server, etcd, scheduler, controller manager) holds desired state; kubelet on each node runs containers via a container runtime (containerd). You declare intent in YAML; controllers reconcile reality.

A Pod is the smallest deployable unit — one or more containers sharing network namespace and volumes. Deployments manage ReplicaSets to run stateless apps with rolling updates. StatefulSets give stable network IDs and persistent volumes for databases. DaemonSets run one pod per node (log agents, node exporters).

Services provide stable cluster DNS names and load balancing to pods. ClusterIP (internal only), NodePort (host port), LoadBalancer (cloud LB), and Headless (direct pod DNS for StatefulSets). Selectors match pod labels — always version your labels and avoid mutable tags like :latest in prod.

Liveness probes restart unhealthy containers; readiness probes remove pods from Service endpoints until ready. Use HTTP /healthz, exec, or TCP checks. readiness must reflect dependency availability (DB connected); liveness should be lightweight to avoid restart loops.

resources.requests reserve scheduling capacity; resources.limits cap CPU (throttled) and memory (OOMKilled if exceeded). Set requests from production p95 usage; limits slightly above. Missing limits allow noisy neighbors; missing requests cause unpredictable scheduling.

ConfigMaps store non-sensitive config as key-value or files; Secrets store sensitive data (base64-encoded, not encrypted by default — enable encryption at rest). Mount as env vars or volumes. Prefer external secret operators (External Secrets, Vault) for rotation.

Ingress (with an Ingress controller like NGINX or Traefik) routes HTTP/S from outside the cluster to Services by hostname and path. NetworkPolicies restrict pod-to-pod traffic — default allow-all is risky in multi-tenant clusters.

kubectl is the primary CLI: apply -f manifest.yaml (declarative), get/describe for inspection, logs -f for streaming, exec -it for shells, port-forward for local debugging. Contexts and namespaces isolate environments — always specify -n production explicitly.

Architecture Diagram

kubectl / GitOps (ArgoCD)
         |
  API Server + etcd (desired state)
         |
  Scheduler --> Kubelet (nodes)
         |
  Pods + Services + Ingress
         |
  PersistentVolume / ConfigMap / Secret

Examples

apiVersion: apps/v1
kind: Deployment
metadata:
  name: api
  labels: { app: api }
spec:
  replicas: 3
  selector:
    matchLabels: { app: api }
  template:
    metadata:
      labels: { app: api }
    spec:
      containers:
        - name: api
          image: myregistry/api:1.2.0
          ports: [{ containerPort: 8080 }]
          resources:
            requests: { cpu: "100m", memory: "128Mi" }
            limits:   { cpu: "500m", memory: "512Mi" }
          livenessProbe:
            httpGet: { path: /healthz, port: 8080 }
            initialDelaySeconds: 10
          readinessProbe:
            httpGet: { path: /ready, port: 8080 }
---
apiVersion: v1
kind: Service
metadata:
  name: api
spec:
  selector: { app: api }
  ports:
    - port: 80
      targetPort: 8080
  type: ClusterIP

apiVersion: v1
kind: ConfigMap
metadata:
  name: api-config
data:
  LOG_LEVEL: info
  FEATURE_FLAGS: "search=true,beta=false"
---
apiVersion: v1
kind: Secret
metadata:
  name: api-secrets
type: Opaque
stringData:
  DATABASE_URL: postgres://user:pass@db:5432/app
---
# In Deployment spec.containers[0]:
#   envFrom:
#     - configMapRef: { name: api-config }
#   env:
#     - name: DATABASE_URL
#       valueFrom:
#         secretKeyRef: { name: api-secrets, key: DATABASE_URL }

kubectl apply -f deployment.yaml
kubectl get pods -n production -w
kubectl describe pod api-7f8b9c-xyz
kubectl logs -f deployment/api -n production
kubectl exec -it api-7f8b9c-xyz -- sh
kubectl port-forward svc/api 8080:80
kubectl rollout undo deployment/api
kubectl top pods -n production

Interview Questions

Best Practices

• Set both requests and limits on every container — missing requests cause noisy-neighbor scheduling; missing limits allow OOM cascades.
• Use readinessProbe separate from livenessProbe — never restart pods that are temporarily slow to accept traffic.
• Pin images by digest or immutable tag in production manifests — floating tags cause surprise rollouts.
• Use kubectl apply with version-controlled YAML, not imperative kubectl create — drift becomes unrecoverable.
• Define PodDisruptionBudgets before cluster upgrades — prevents voluntary evictions from taking down all replicas.
• Label everything consistently (app, env, version) — selectors and NetworkPolicies depend on them.

Common Mistakes

• Using latest image tags in Deployment specs — nodes pull different versions; rollouts become non-deterministic.
• Omitting resource requests — pods pack onto nodes until the kernel OOM-kills random processes cluster-wide.
• Liveness probe hitting the same endpoint as readiness with tight timeouts — transient slowness causes restart loops.
• Running one replica of stateful services with no PDB — a single node drain takes the service offline.
• Granting cluster-admin to CI service accounts — one leaked token compromises the entire cluster.

Cheat Sheet

Practical Exercises